Re: Protection from SQL injection - Mailing list pgsql-sql

Hi,

> providing a mode in which the server would reject PQexec strings containing more than one query.

That wouldn't help a lot. The simple SQL injection is not detected:

ResultSet rs = stat.executeQuery( "SELECT * FROM USERS WHERE PASSWORD='" + password + "'");

An attacker would only need to use the following password:

' OR 1=1

The the SQL statements is still only one query:

SELECT * FROM USERS WHERE PASSWORD='' OR 1=1

Regards,
Thomas